bioneural.net

A friend brought an impending WordPress security exploit to my attention, in the form of a CookieMonster. Your data might be at risk if you administer your blog from a public Internet connection (e.g. WiFi in a café). Securing your authentication cookies with Secure Sockets Layer (SSL) provides a defensive countermeasure for your admin loggins, and WordPress.com users now have a checkbox to "Always use HTTPS when visiting administration pages". That checkbox is absent in self-hosted WordPress 2.6.2, but here's how to enable HTTPS and accelerate your admin sessions using Google Gears via Safari.

Lock up all your cookies with a secret key

You may have already defined a SECRET_KEY to secure the cookies that store information about your visitors, a feature introduced in WordPress 2.5. If you didn't do this visit key generator 1.0 and copy the output into your wp-config.php file after the opening PHP tag, so it looks something like this (don't use this one):

<?php
define('SECRET_KEY', '(X9v\'lSG|Y<CHd{.<t?Q0oT(;G8Q.kh&`7kf0V7:nu]3)KSGX-y-CF",H*7AN!#^');

Before we turn on SSL we can visit key generator 1.1 and define secret keys for the secured cookie we will be using shortly. Add this output to wp-config.php below the SECRET_KEY, like so:

<?php
define('SECRET_KEY', '(X9v\'lSG|Y<CHd{.<t?Q0oT(;G8Q.kh&`7kf0V7:nu]3)KSGX-y-CF",H*7AN!#^');
define('AUTH_KEY', ')hL="XKt8S~T1iX/af=Ru5yp2Mk"d[CDAcyo? &ee4XNmQ%.U!{gO_56>06-lg_X');
define('SECURE_AUTH_KEY', 'q&E61L6#L0W=%(ll(G.Ig6QO>J9-DOl,<u+&.5uo@oF=sm0VxhO}/EkAN7Dou>\\$');
define('LOGGED_IN_KEY', '?O!gD|,y]Pe*WF0~%<%>[Om\\\'wwvRpM;xtye^TU9,O.]P9<\'kQa;: kMJzwf?hN0');

Force admin sessions to use a SSL connection

Now that all our cookies are protected the next step is to force all sessions when we log on as Administrator to use SSL. Under the code block above, add the following:

define('FORCE_SSL_ADMIN', true);

When you next attempt to access /wp-admin pages of your site, you'll see a dialogue like this:

Don't be alarmed; you can just click continue and you should notice two reassuring changes. The first is that your admin pages are prefixed by https:// e.g.:

And the second is the appearance of a padlock symbol in the top right of the Safari window:

Why is my certificate "invalid"?

Because you're using a self-signed SSL certificate, the authenticity of which can't be verified by the third-party signing authority. If instead of clicking Continue as above, click on Show Certificate to reveal more information:

In this example because bioneural.net is hosted on a Media Temple Gridserver, their certificate isn't a match for my domain. I could buy my own certificate (Media Temple users see here), but I'd rather not spend $US170 since I'm happy to trust the identify of my own hosting company! If you are likewise convinced that you are in fact connecting to your web host, check the box in the above window that reads:

Always trust "(your host)" when connecting to "(your domain)"

You will need to authenticate using your OS X password, after which you will no longer see the invalid certificate warning every time you log in. The padlock will still show, and your information will continue to be encrypted.

Slow going?

One possible side effect from using SSL is slow connections (it takes time to encrypt and decrypt everything). WordPress includes support for Google's browser extension called Gears, just released for Safari.

Gears is what that Turbo link in the WP admin area is all about:

It's called "Turbo" because is speeds things up; Gears downloads most of your WordPress installation files to your local disk drive for faster access. On clicking the link you'll see the following pop-up:

Clicking Install Now will take you to Google and download a disk image called gears-osx-opt.dmg. Quit Safari and run the installer, then relaunch Safari and hit the Turbo link in WP Admin once more. You will be prompted to enable Gears:

Be patient while the files from your online WordPress installation are being copied to local storage:

Once this is done Gears should be playing nicely with WordPress. Safari has a new Google Gears Settings menu option which allows you to control permissions or remove this facility from your WordPress blog or from other sites that can use Gears:

Does this secure admin from iPhone Safari?

Yes it does. You'll get a variation on the "invalid" certificate warning, followed by a padlock icon in the address bar if you click Accept:

There's no iPhone version of Gears to accelerate these sessions, however.

Actions Send this article link by e-mail Print this article without other content Follow responses to this article: comments Follow tag feeds: google, howto, Internet, iphone, Mac, php, security, webdev, wordpress. Share on Delicious Digg Facebook StumbleUpon Twitter Translate this page: DE | ES | FR